90c4ced19038b7b2743b059df070a3eff46c8be01d70471ad7689fac1034b954

Analysis

max time kernel
41s
max time network
107s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Awaiting for your confirmation.doc
Size

519.3MB
MD5

11cd91227374eb49e26c0714e04b1a4b
SHA1

f2cfc55d9c79958abfd41d4e87d105201ad6ea9f
SHA256

6d4ac73f163c4ce1d075347af07a6c7a418c60de3ba8fc625edc4a82316316b9
SHA512

a81762954e2e00be6e62f02cf496319bf5444f40b2291045dbeb6239ce9eef310468b988c20d1b4d2697b77dab4bd5ab865a96eb6aad3620623f508ad5919f85
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1096	1976	regsvr32.exe	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
1976 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1976 WINWORD.EXE
1976 WINWORD.EXE

pid	process
1976	WINWORD.EXE

pid	process
1976	WINWORD.EXE
1976	WINWORD.EXE

pid	process
1976	WINWORD.EXE
1976	WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Awaiting for your confirmation.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\134310.tmp"
2⤵
- Process spawned unexpected child process
PID:1096

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\134310.tmp"
3⤵
PID:1472

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TrPnKHnRlXIlKO\pnugToEeubarugL.dll"
4⤵
PID:2032

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
05ed8fbc224e66e1fb1a6ee7a7856c31

SHA1
eb79047265075dffae4410a415f0514afc991872

SHA256
95c291c0cd7e0211b2966afcd2c63f24babf913b7d86e504a1e739d1533c270d

SHA512
66647aafe765f72882f5deeb4799d62a7839d5b9d60b88dfcfb5de07f26d2170c7e7e68b985755c9ddd94d5f6b662e2ab3dcc6d449e5d5a9b7a07e8e75743ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\134310.tmp
Filesize
515.1MB

MD5
6a010d7359830895b50763a688a91de6

SHA1
452b18deefbbb25c2fd955261f12d9873fb5f3f2

SHA256
2fd7ec9195ac92e7e9e66ffc46aa52cfcd82f3e333e957db236f817056a04d7b

SHA512
e48fde494f41d03a28ccf85552f261925a993c2130e71c4803a916c12f2148b3d7ac4c851d5025011804d6a48aff52dbb616e5d6e1b0cf1dfdc8cef691dc44b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\134328.zip
Filesize
829KB

MD5
b5735621a1ff41aa190380856e7635b4

SHA1
61f0832f1ec68f017ae3ff97b5238e055ec1788f

SHA256
1639ae2dae63b4d1df66ddaa4bb94adcc183f925afdbd2cbb1b59095f9b560b5

SHA512
acaad69d0dc52035395cfd60258f4d1f07f527379a31314c0352762233d1cc295cc860d4ae2247c0bb7bf9f554e9350d05e3ef9921f36393b4304ac743f781ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F53.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar60D1.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
f7e0bbd2ef765f3d5675111b709e044d

SHA1
7b804094e4d6a31fb1370115045ad955a0563cf5

SHA256
34ab5e8acfcd8e59998577e111ddc6b330a5e5f42049ec344daea6e8c1de8ed4

SHA512
00a15ac2259b20ab3aba05dce8b3e663219a3c48bc03dd6e4ba0a8e95fea42c5a8c90373415f423f4fa0da5a2b61278d55dc0df57fc588634fbda638c1d97459

Download Submit
\Users\Admin\AppData\Local\Temp\134310.tmp
Filesize
523.5MB

MD5
bdcbd67c023c8572b6b7aedf3d326f45

SHA1
70111bf00b6357316648d1cc8b6d1e4d56c350d0

SHA256
7bbbec1a5a9a6e676952be7aaad483087463516a7acdabc8effc42909cd65fce

SHA512
6c242ec9cfb05f854cdc1439e24e9a59bc7f3fd631a11b8aec6c52bd0f1816bc072946cabe74cc7dc8dae4aa5adbbf478818f922ed8b8ed9a507c1769aeea65e

Download Submit
\Users\Admin\AppData\Local\Temp\134310.tmp
Filesize
523.5MB

MD5
bdcbd67c023c8572b6b7aedf3d326f45

SHA1
70111bf00b6357316648d1cc8b6d1e4d56c350d0

SHA256
7bbbec1a5a9a6e676952be7aaad483087463516a7acdabc8effc42909cd65fce

SHA512
6c242ec9cfb05f854cdc1439e24e9a59bc7f3fd631a11b8aec6c52bd0f1816bc072946cabe74cc7dc8dae4aa5adbbf478818f922ed8b8ed9a507c1769aeea65e

Download Submit
memory/1472-1412-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1976-83-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-89-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-63-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-64-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-66-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-65-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-67-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-68-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-69-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-70-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-71-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-72-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-73-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-74-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-76-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-77-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-78-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-80-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-81-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-82-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-60-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-84-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-86-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-87-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-90-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-62-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-91-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-93-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-94-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-95-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-92-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-96-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-97-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-100-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-99-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-98-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-88-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-85-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-79-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-75-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-101-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-102-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-104-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-1215-0x0000000006500000-0x0000000006501000-memory.dmp

Filesize
4KB

Download
memory/1976-61-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-59-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-58-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-57-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/1976-1413-0x0000000006500000-0x0000000006501000-memory.dmp

Filesize
4KB

Download
memory/1976-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2032-1414-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download